partially-applied: [PATCH container/manager v2 0/7] implement per-mountpoint uid/gid mapping

[Wolfgang Bumiller <w.bumiller@proxmox.com>]

applied the pve-container parts (without the d/control patch as it has
become obsolete)

On Mon, Mar 30, 2026 at 04:10:11PM +0200, Filip Schauer wrote:
> Add support for configuring UID/GID mappings on individual container
> mount points without affecting the global container mapping.
> 
> A new "idmap" mount point option accepts semicolon-separated mappings:
> ```
> idmap=type:ct:host:len;type:ct:host:len;...
> ```
> 
> type: can be either 'u' or 'g'
> ct: ID as seen inside the container
> host: corresponding ID on the host
> len: number of consecutive IDs to map
> 
> Unmapped ranges inherit the container's ID mapping.
> 
> Example to pass through the host UID & GID 1005:
> ```
> mp0: /mnt/data,mp=/data,idmap=u:1005:1005:1;g:1005:1005:1
> ```
> 
> To identity-map the entire range of ids, "passthrough" can be used:
> ```
> idmap=passthrough
> ```
> 
> Mount point idmapping only works for unprivileged containers. Privileged
> containers are unaffected.
> 
> Build/Bump order:
> * pve-container
> * pve-manager
> 
> Changes since v1:
> * Include $msg in error message in sync_send/sync_recv
> * Switch idmap from space-separated to semicolon-separated
> * Improve documentation of idmap option
> * Add 'idmap=passthrough'
> * Cache user namespace file descriptors in memory at container startup
>   to avoid overhead of re-creating duplicates
> 
> pve-container:
> 
> Filip Schauer (5):
>   namespaces: relax prototype of run_in_userns
>   namespaces: refactor run_in_userns
>   d/control: update versioned dependency for libpve-common-perl
>   namespaces: add helper to create user namespace from idmap
>   implement per-mountpoint uid/gid mapping
> 
>  debian/control            |  2 +-
>  src/PVE/LXC.pm            | 96 +++++++++++++++++++++++++++++++++++++--
>  src/PVE/LXC/Config.pm     | 39 ++++++++++++++++
>  src/PVE/LXC/Namespaces.pm | 63 ++++++++++++++++++++-----
>  src/lxc-pve-prestart-hook | 23 ++++++++++
>  5 files changed, 206 insertions(+), 17 deletions(-)
> 
> 
> pve-manager:
> 
> Filip Schauer (2):
>   ui: lxc/MPEdit: remove duplicate "mp" assignment
>   ui: lxc/MPEdit: add "idmap" option
> 
>  www/manager6/lxc/MPEdit.js | 213 ++++++++++++++++++++++++++++++++++++-
>  1 file changed, 212 insertions(+), 1 deletion(-)
> 
> 
> Summary over all repositories:
>   6 files changed, 418 insertions(+), 18 deletions(-)
> 
> -- 
> Generated by git-murpp 0.6.0
> 
> 
> 
> 

--